The code review skill from Addy Osmani's agent-skills repository: Before merging (or when reviewing code written by other agents or people), have the agent review changes across five dimensions—correctness, readability, architecture, security, and performance. Review tests before implementation, label each comment with a severity level (Critical / Must Fix / Nit / Optional / FYI), and conclude with either approval or a request for changes.
skills.sh install count 79294 (+975 / 24h)
Security Audit: Not audited
- Not yet scanned
Rationale
- The process consists of 5 steps: first clarify the intent of the changes, then review tests first, followed by reviewing implementation file-by-file across the five dimensions, listing issues by severity, and verifying the author's validation notes; before reporting, cross-check against callers, guards, and tests to eliminate false positives, with zero issues being a valid conclusion, and no forced findings allowed
- Determining test validity relies on experimentation: negate one condition in the changes and run the tests, then restore the file from a copy; if tests still pass, it indicates missing test cases, and the specific missing case must be identified
- Provides guidelines for change size (approximately 100 lines are suitable for a single review, while approximately 1000 lines should be split) and four splitting methods; for dependency upgrades, read changelogs, upgrade one package at a time, and review lockfile diffs
- When discovering unused code, list it first and ask whether to delete it, rather than deleting it arbitrarily; when raising structural issues, provide specific refactoring suggestions alongside
- The repository is MIT licensed, and the same repository contains 24 other skills; skills.sh shows 975 installs in 24 hours, with a cumulative total of 79294, and weekly installs over the last 8 weeks have risen from 3503 to 5359 (indicating attention only)
Usage
- The installation command will be displayed after the audit passes; triggered when saying "review this PR / diff", when a feature is complete and ready to merge, or when evaluating code written by other agents
- No account or external services are required; the step "negate a condition and run tests" requires the ability to run the project's tests locally
Risks
- Not audited in this cycle, fixed at Grade C, and the installation command is not displayed; SKILL.md is primarily a review checklist, and the only action that modifies files is "temporarily negating a condition to run tests, then restoring from a copy," which aligns with its purpose, but file restoration must be confirmed; on skills.sh, the Gen Agent Trust Hub and Socket audits are Pass, while Snyk is Warn
- The security and performance sections reference the security-and-hardening and performance-optimization skills in the same repository, as well as checklist files in the repository root; these links may not be accessible if only this skill is installed
- The approval criteria are relatively lenient: approval is granted as long as the overall code health improves; team norms such as "reply within one business day" are less meaningful for solo projects